Browse public community intelligence reports, source analysis, and threat research.
157 intel reports
Iranian state cyber actors are using CHOSEN BRICK, a Windows-based spyware, to monitor dissidents and activists through social engineering and Telegram-based command and control.
The Gentlemen threat actor group is utilizing the cross-platform TukTuk C2 framework and BYOVD techniques to neutralize EDR solutions while targeting global technology and healthcare sectors.
Storm-2570 is a versatile ransomware affiliate utilizing consistent post-compromise tools like MeshAgent, ntdsutil, and s5cmd to deploy multiple ransomware families including Qilin and DragonForce.
Purple Ghosts compromised over 14,000 Dahua cameras globally using an authentication-bypass chain and P2P relay exploitation to install persistent backdoors and harvest credentials.
The threat actor Larva-25012 is utilizing the DPLoader malware to distribute various Proxyware SDKs like DigitalPulse and SOAX to monetize infected systems' bandwidth.
The RevStealer infostealer uses trojanized Electron applications and blockchain-based C2 failover to target credentials, cryptocurrency wallets, and browser data on Windows systems.
INC Ransomware threat actors utilize Bring Your Own Vulnerable Driver (BYOVD) tactics and dual ransom notes to pressure victims after exfiltrating data via tools like MEGASync.
The Iran-linked threat actor Handala Hack uses the HEAVYGRAM Telegram-based backdoor and CRUDEEXCLUDE utility to target dissidents and journalists for surveillance and data exfiltration.
Koktevrat is a multi-stage Android RAT distributed via a fake Polish government application named MandatGO that utilizes Accessibility Services and Firebase for full device control.
The NightEagle APT group (APT-Q-95) is targeting Russian businesses by deploying the GhostContainer backdoor on Microsoft Exchange servers and utilizing legitimate tunneling tools for lateral movement.
